Associated Radiologists of the Finger Lakes, P.C. Data Breach

Associated Radiologists of the Finger Lakes, P.C., a medical imaging and diagnostic radiology practice based in New York, experienced a significant data breach involving unauthorized access to its network server infrastructure. The breach was discovered and reported to the New York Department of Health on December 29, 2025, affecting 501 individuals whose protected health information (PHI) was stored on the compromised network systems. This incident represents a serious security failure at a healthcare entity responsible for storing sensitive diagnostic imaging records and associated patient medical data.

Company Response

Upon discovery of the unauthorized access to their network server, Associated Radiologists of the Finger Lakes initiated an investigation to determine the scope and nature of the breach. The organization worked to identify which patient records were accessed, what specific data elements were compromised, and the timeline of the unauthorized access. As required under HIPAA Breach Notification Rule (45 CFR §§ 164.400-414), the organization notified affected individuals of the breach and submitted notification to the New York Department of Health. The submission date of December 29, 2025, indicates the breach was reported within the required 60-day notification window following discovery of the unauthorized access.

Specific Details

Network server breaches typically occur through one or more attack vectors, including exploitation of unpatched software vulnerabilities, weak authentication credentials, phishing attacks targeting employee credentials, or compromised remote access points. When a network server is breached, attackers gain access to centralized data repositories that may contain multiple years of patient records, diagnostic imaging files, and associated clinical documentation. The fact that a business associate was involved in this breach suggests that either the business associate's systems were compromised and used to access Associated Radiologists' network, or that the business associate had legitimate access to the network and experienced a security incident affecting that access. Business associates in healthcare typically include IT service providers, cloud storage vendors, billing companies, or other entities that handle PHI on behalf of the covered entity.

Network server compromises are particularly concerning because they can provide attackers with broad access to large volumes of data simultaneously, rather than isolated patient records. The breach location being identified as "Network Server" indicates that the primary point of compromise was the organization's internal IT infrastructure rather than a portable device, paper records, or a specific application. This type of breach often requires sophisticated technical remediation, including forensic investigation, system hardening, vulnerability patching, and potentially complete infrastructure rebuilding in severe cases.

Organizational Context

Associated Radiologists of the Finger Lakes, P.C. is a medical practice specializing in diagnostic radiology and medical imaging services. The organization operates in the Finger Lakes region of New York State, serving patients across multiple counties in central New York. As a radiology practice, the organization maintains extensive digital imaging files (CT scans, MRI images, X-rays, ultrasound studies) along with associated clinical reports, patient demographics, medical histories, and insurance information. Radiology practices are particularly attractive targets for cybercriminals because imaging files are large, numerous, and contain detailed anatomical information that can be valuable for identity theft or medical fraud.

Number of People Affected

The breach affected 501 individuals whose information was stored on the compromised network server. While this number is below the 1,000-person threshold for some reporting categories, the sensitivity of the data involved and the nature of the breach vector elevate the severity. All 501 affected individuals received breach notification letters informing them of the unauthorized access, the types of information compromised, and recommended protective measures. The organization was required to provide these notifications at no cost to the affected individuals.

Personal Information Involved

Given the nature of a radiology practice, the compromised data likely includes:

• Medical imaging files: CT scans, MRI images, X-ray studies, ultrasound images, and other diagnostic imaging studies
• Clinical reports: Radiologist interpretations and diagnostic reports associated with imaging studies
• Patient demographics: Names, addresses, dates of birth, phone numbers, and email addresses
• Insurance information: Health insurance policy numbers, group numbers, and subscriber information
• Medical history: Clinical diagnoses, medical conditions, treatment history, and physician names
• Social Security numbers: Potentially included in patient registration and insurance verification records
• Financial information: Billing records, payment information, and account numbers

The exposure of medical imaging and diagnostic reports is particularly sensitive because these records reveal detailed information about a patient's health conditions, including cancer diagnoses, neurological conditions, cardiac issues, and other serious medical conditions.

Likely Risks to Patients

Individuals affected by this breach face several specific risks:

Identity Theft: With access to names, dates of birth, Social Security numbers, and addresses, criminals can open fraudulent accounts, apply for credit, or file false tax returns in victims' names.

Medical Identity Theft: Attackers can use stolen medical information to obtain prescription medications, schedule medical procedures, or file false insurance claims, potentially creating fraudulent medical records that could interfere with legitimate future care.

Insurance Fraud: Insurance policy numbers and subscriber information can be used to file false claims or obtain unauthorized medical services.

Targeted Phishing and Social Engineering: Criminals with detailed medical information can craft highly convincing phishing emails or phone calls impersonating healthcare providers or insurance companies.

Discrimination and Stigma: Exposure of sensitive diagnostic information (such as cancer, HIV, mental health conditions, or reproductive health issues) could lead to employment discrimination, insurance discrimination, or social stigma if the information is publicly disclosed.

Ransomware Complications: If the breach was part of a ransomware attack, there is elevated risk that the stolen data may be sold on dark web marketplaces or used for extortion purposes.

Recommended Actions for Patients

1. Monitor Credit Reports: Obtain free credit reports from all three major credit bureaus (Equifax, Experian, TransUnion) at annualcreditreport.com and review for unauthorized accounts or inquiries. Consider placing a fraud alert or credit freeze with each bureau to prevent unauthorized credit applications.

2. Monitor Medical Records and Insurance Claims: Request copies of medical records from Associated Radiologists and other healthcare providers to verify accuracy. Monitor Explanation of Benefits (EOB) statements from your health insurance for unauthorized claims or services you did not receive.

3. Implement Identity Theft Protection: Consider enrolling in credit monitoring and identity theft protection services. Many breach notifications include offers for complimentary credit monitoring for a specified period (typically 12-24 months).

4. Change Passwords and Enable Multi-Factor Authentication: If you have online patient portals or accounts with Associated Radiologists or related healthcare entities, change your passwords to strong, unique credentials and enable multi-factor authentication where available.

5. Report Suspicious Activity: If you notice unauthorized accounts, fraudulent charges, or suspicious medical claims, report them immediately to your financial institutions, insurance companies, and the Federal Trade Commission (FTC) at identitytheft.gov.

Industry Context

Network server breaches represent one of the most common categories of healthcare data breaches, accounting for a significant percentage of HIPAA breach notifications each year. According to HHS Office for Civil Rights data, hacking and IT incidents consistently rank among the top breach types affecting healthcare organizations. These breaches often result from inadequate network security controls, including unpatched systems, weak access controls, insufficient encryption, and inadequate monitoring of network activity.

Under HIPAA regulations, covered entities and business associates are required to implement administrative, physical, and technical safeguards to protect PHI. Network server breaches often indicate failures in one or more of these safeguard categories. The involvement of a business associate in this breach highlights the importance of Business Associate Agreements (BAAs) and vendor management in healthcare cybersecurity. Healthcare organizations are responsible for ensuring that their business associates maintain appropriate security controls and promptly notify the covered entity of any breaches affecting PHI.

The Finger Lakes region of New York has experienced multiple healthcare data breaches in recent years, reflecting broader national trends in healthcare cybersecurity incidents. Healthcare providers in rural and semi-rural areas sometimes face particular challenges in maintaining strong cybersecurity infrastructure due to resource constraints and competition for IT security talent.